Secure by Design Mental Model

When I get invited into conversations with developers about “security,” the focus is often on one thing: passing the penetration test right before go-live.

But here’s what many don’t see. Security isn’t a box to check at the end — it’s a discipline woven in from the very start.

Last night, I spent 10 minutes sketching out the mental model I use when a company asks me to help them build an application that’s “secure by design”.

Continue reading →